RTF malware analysis — malicious · 0876a96adfaac1d3

MALICIOUS

RTF

8.3 KB First seen: 2023-02-22

MD5: 064f9aff6b9e7c26168df24a193507c8 SHA-1: 88a94aa39d5eefeac209f3c6bcdf75692ddd4b4a SHA-256: 0876a96adfaac1d33ef1984e9e2cfe74b41bafd8bee502bb56688064047efe84

60 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.002 Malicious Link: Malicious File

The RTF file contains OLE object data and an \objupdate directive, indicating it's designed to activate embedded objects. The document body contains a message in Spanish instructing the user to 'click the enable editing icon above if you cannot read the content of this document', which is a social engineering tactic to bypass security warnings and enable macros or other active content.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000013d8.bin` `df0d5d1c6884ef22a4cc8b0cb9ab441dd5b553be9f7b8db305aea8014ebac421`	rtf-objdata-decoded	RTF \objdata at offset 0x13D8	1679 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.